Gardener Backup Restore – Cross‑Provider Targeting Not Supported

Goal and Constraints

The objective is to restore a Gardener backup to a cluster that uses a different control‑plane provider or is located in another region. Gardener’s backup feature creates a full etcd snapshot and stores it in an object‑storage bucket. The snapshot is tied to the original infrastructure configuration, and the restore operation can only target a freshly created cluster; it cannot be applied to an existing cluster or to a cluster on a different provider.

Likely Explanation

Gardener’s restore controller validates that the target shoot’s provider matches the backup’s provider before proceeding. Provider‑specific fields such as machine‑deployment references, cloud‑provider secrets and status objects are embedded in the backup metadata. Without stripping or remapping these fields, a restore to a different provider results in incompatible API requests and orphaned resources.

Confirmed Facts

• Gardener stores an MD5 or SHA‑256 checksum of the etcd snapshot in the backup’s metadata.
• The restore workflow does not automatically recompute or compare this checksum after restoration.
• Post‑restore resource reconciliation relies on the shoot’s normal reconciliation loop, which may miss objects that were not part of the etcd snapshot.

Required Workflow Changes

1. During restore, the controller must strip provider‑specific keys from the backup (machine‑deployments, cloud‑provider credential references, provider status).
2. Re‑generate machine‑deployments and other infrastructure objects using the target shoot’s provider configuration (e.g., via the shoot’s provider spec).
3. Update the backup metadata to include a reference to the target provider so future restores can be routed correctly.

Checksum Verification Step

An automated integrity check can be added by:

1. Reading the stored hash from the backup metadata.
2. After the etcd snapshot is restored, running etcdctl snapshot status <restored-snapshot> --hash to compute the current hash.
3. Comparing the two values; if they differ, abort the restore and log the mismatch.

This step requires etcdctl to be available in the restore environment and the etcd version used during backup to support the --hash flag.

Post‑Restore Resource Validation

To verify that all expected cluster resources are present after restore, operators can:

1. Before taking the backup, export the shoot’s desired state: kubectl get all,secrets,configmaps -n <shoot-namespace> -o yaml > pre‑backup.yaml.
2. After restore, export the current state: kubectl get all,secrets,configmaps -n <shoot-namespace> -o yaml > post‑restore.yaml.
3. Run a diff (e.g., diff pre‑backup.yaml post‑restore.yaml) or apply a pruned apply: kubectl apply -f post‑restore.yaml --prune‑finalizers to reconcile missing objects.
4. Optionally, leverage Gardener’s shoot reconciliation loop, which will reconcile the shoot spec against the restored state.

Note: Dynamic objects that are generated at runtime (e.g., workload‑created ConfigMaps) may not appear in a static export; validation should focus on objects declared in the shoot spec.

Missing Diagnostic Detail

To finalize the recommendation, please confirm the Gardener version in use and whether the target shoot’s provider type is supported by the backup’s etcd snapshot format. This information determines whether the outlined changes can be applied without custom controller modifications.